- 
                Notifications
    
You must be signed in to change notification settings  - Fork 3.8k
 
Open
Labels
Bugthing that needs fixingthing that needs fixingPriority 1high priority issuehigh priority issueRelease 8.xwork is associated with a specific npm 8 releasework is associated with a specific npm 8 release
Description
Is there an existing issue for this?
- I have searched the existing issues
 
This issue exists in the latest npm version
- I am using the latest npm
 
Current Behavior
If you run npm install in a project that has a yarn.lock file, npm changes both the syntax, data and order of yarn.lock file.
Changes I've spotted that shouldn't happen:
- npm adds double-quotes around everything (
is-number@^7.0.0:becomes"is-number@^7.0.0":,versionbecomes"version"and so on) - Registry URLs get overwritten (
"https://registry.yarnpkg.com/is-number/-/is-number-7.0.0.tgz#7535345b896734d5f80c4d06c50955527a14f12b"becomes"https://registry.npmjs.org/is-number/-/is-number-7.0.0.tgz") - Order of keys becomes shuffled (
yarn.lockhasversion,resolved,integrityin that order, afternpm install, the order becomesintegrity,resolved,version) 
Expected Behavior
No commands run with npm should modify files npm doesn't have anything to do with, namely yarn.lock which is managed by a different program than npm.
Steps To Reproduce
cd $(mktemp -d)Create new temporary directory for a test projectnpm init --yesCreate new package.jsonnpm install --save is-numberAdd a dependencyyarn installInstall dependencies via yarn, creating theyarn.lockfilecp yarn.lock yarn.lock.originalSave a copy of the originalyarn.lockfilenpm installRun npm install again which modifies theyarn.lockfile unexpectedlydiff yarn.lock yarn.lock.originalshow the difference between the npm-modified yarn.lock file with the original one that yarn itself produces
Environment
- npm: 
8.13.2 - Node.js: 
v18.4.0 - OS Name: 
Arch Linux - System Model Name: 
Desktop - npm config:
 
; "user" config from /home/user/.npmrc
//registry.npmjs.org/:_authToken = (protected)
; node bin location = /home/user/.nvm/versions/node/v18.4.0/bin/node
; node version = v18.4.0
; npm local prefix = /tmp/tmp.YKcr2lMqCS
; npm version = 8.13.2
; cwd = /tmp/tmp.YKcr2lMqCS
; HOME = /home/user
; Run `npm config ls -l` to show all defaults.goncharov, alamothe, Archez, buo, cachius and 12 more
Metadata
Metadata
Assignees
Labels
Bugthing that needs fixingthing that needs fixingPriority 1high priority issuehigh priority issueRelease 8.xwork is associated with a specific npm 8 releasework is associated with a specific npm 8 release